HACS Penetration Testing: How Agencies Buy Pen Testing Through GSA

Quick answer: HACS penetration testing is penetration testing purchased through the GSA Multiple Award Schedule under the Highly Adaptive Cybersecurity Services (HACS) Special Item Number, SIN 54151HACS. HACS gives federal agencies, and through cooperative purchasing many state and local governments, a faster way to buy pre-vetted cybersecurity services, including penetration testing, risk and vulnerability assessments, high value asset assessments, incident response and cyber hunt. Vendors must pass a technical evaluation before they can offer HACS services, so buyers start from a qualified pool.

Government organizations need regular security testing to meet FISMA and NIST requirements, protect high value assets and respond to growing threats. Running a full open-market procurement for every test is slow. HACS was created to shorten that cycle while keeping quality high, and it has become one of the most common ways for agencies to buy penetration testing.

This guide explains what HACS is, which services it covers, how agencies buy penetration testing through it, what a good statement of work includes and how to choose a vendor. To learn how to work with Privaxi through GSA, explore Privaxi's GSA schedule services.

What Is HACS?

Highly Adaptive Cybersecurity Services is a Special Item Number on the GSA Multiple Award Schedule within the Information Technology category. GSA built HACS in coordination with other federal agencies to give buyers quick access to vendors that have been technically evaluated for specific cybersecurity services. Contract terms, pricing and ordering procedures are already in place, so agencies can move from requirement to task order much faster than with a new open-market contract.

What Is HACS Penetration Testing?

HACS penetration testing is the penetration testing subcategory of HACS. Qualified vendors safely simulate real attacks against an agency's networks, applications and people to find weaknesses before adversaries do, then document findings and remediation guidance. Testing commonly supports NIST SP 800-53 control CA-8, penetration testing, along with assessments required for authorizations and continuous monitoring. Methods typically follow recognized guidance such as NIST SP 800-115.

For background, see our guides to NIST 800-115 penetration testing and government penetration testing.

HACS Service Subcategories

Many agencies combine subcategories in one task order, for example a risk and vulnerability assessment that includes penetration testing, followed by remediation verification.

Who Can Buy Through HACS?

• Federal agencies: civilian and defense organizations can order directly from the GSA schedule.
• State and local governments: the Cooperative Purchasing program allows many state, local, tribal and territorial governments to buy IT schedule services, including HACS.
• Other eligible entities: certain other organizations may be eligible under GSA rules.

Eligibility details and ordering procedures can change, so confirm with your contracting officer and GSA guidance before ordering.

Benefits of Buying Penetration Testing Through HACS

• Pre-vetted vendors: vendors pass a technical evaluation before they can offer HACS services.
• Faster procurement: established terms and pricing shorten the path to a task order.
• Competitive pricing: schedule pricing has already been determined fair and reasonable, and agencies can still compete orders.
• Flexibility: agencies can buy one test, a recurring program or a blanket purchase agreement.
• Small business options: many HACS vendors are small businesses, supporting set-aside goals.

Using HACS penetration testing lets security teams focus on scope and results instead of long procurement cycles.

How Agencies Buy HACS Penetration Testing

1. Define the requirement: describe the systems, objectives and compliance drivers for testing.
2. Engage the contracting officer: confirm the ordering approach and any set-aside considerations.
3. Identify qualified vendors: use GSA tools to find vendors offering the HACS penetration testing subcategory.
4. Issue a request for quote: share a clear statement of work and evaluation criteria.
5. Evaluate and award: compare technical approach, experience, staffing and price.
6. Kick off and test: agree rules of engagement, authorizations and communication plans before testing begins.
7. Receive results and remediate: review findings, fix issues and request retesting.

What a Strong Statement of Work Includes

• Systems and environments in scope, including IP ranges, applications, cloud accounts and locations.
• Testing types: external, internal, web application, wireless, social engineering or a combination.
• Compliance drivers, such as FISMA, an authorization to operate, HVA requirements or FedRAMP.
• Rules of engagement, testing windows, safeguards and points of contact.
• Required tester qualifications, certifications and any clearance or citizenship requirements.
• Deliverables, such as executive summaries, technical reports, raw evidence and retest letters.
• Data handling requirements for any sensitive information encountered.
• Timeline, milestones and options for follow-on testing.

A clear statement of work helps vendors quote accurately and makes HACS penetration testing results easier to use for authorization and oversight. Our guide to penetration testing scope explains how to prioritize.

Typical Scope for Government Penetration Tests

• External perimeter: public websites, portals and remote access. See external penetration testing.
• Internal networks: workstations, servers and identity systems. See internal penetration testing.
• Citizen-facing applications: benefit portals, payment systems and APIs. See web application penetration testing and API penetration testing.
• Cloud systems: agency cloud tenants and FedRAMP-authorized services. See cloud penetration testing and FedRAMP penetration testing.
• Wireless networks: office and facility Wi-Fi. See wireless penetration testing.
• People and processes: authorized phishing exercises. See social engineering penetration testing.
• High value assets: systems designated as HVAs and the paths that lead to them.

Common Findings in Government Environments

• Legacy systems that cannot easily be patched or upgraded.
• Accounts and remote access without phishing-resistant multi-factor authentication.
• Excessive privileges and weak controls over administrator accounts.
• Weak segmentation between general networks and sensitive systems.
• Authorization flaws in citizen-facing applications.
• Misconfigured cloud resources and identity settings.
• Gaps in logging and alerting for realistic attacker activity.

For a structured approach to closing gaps, read our guide to penetration testing remediation.

Using Results for Authorization and Oversight

Penetration test results feed security assessment reports, plans of action and milestones, authorization decisions and continuous monitoring. Agency leaders and inspectors general also review testing as evidence that the security program works. A good HACS penetration testing report includes a clear executive summary, defined scope, methodology, risk-rated findings, evidence and remediation guidance that maps easily to control requirements. Our guide to the penetration testing report explains what a strong report includes.

Choosing a HACS Vendor

• Confirmed HACS listing for the penetration testing subcategory.
• Experience testing federal, state or local government environments.
• Understanding of FISMA, NIST SP 800-53, HVA and FedRAMP requirements.
• Qualified, certified testers and any required clearances.
• Manual testing expertise, not just automated scanning.
• Reports that map to control requirements, plus remediation support and retesting.

Our guide to choosing a penetration testing company lists more questions to ask.

Cost of HACS Penetration Testing

The cost of HACS penetration testing depends on the size and complexity of the environment, the number of applications and locations, testing types, staffing requirements such as clearances and the deliverables required. Schedule pricing gives agencies a starting point, and competition among qualified vendors can improve value. For pricing factors, see penetration testing cost.

Common Mistakes to Avoid

• Writing a vague statement of work that leads to mismatched quotes.
• Treating a vulnerability scan as a penetration test.
• Leaving cloud services or citizen-facing applications out of scope.
• Skipping rules of engagement and stakeholder coordination before testing.
• Failing to plan budget and time for remediation and retesting.
• Buying one test without a plan for recurring testing.

Working Well With Your Testing Team

The best results come from close communication. Hold a kickoff meeting to confirm scope and rules of engagement, schedule short status updates during testing and ask the vendor to report critical findings immediately rather than waiting for the final report. After the report is delivered, a readout meeting with system owners, security staff and leadership helps everyone understand the risks, agree on priorities and assign owners for each fix.

Building a Recurring Testing Program

Government security programs benefit from regular, planned testing rather than one-off projects. A blanket purchase agreement or multi-year task order can support annual HACS penetration testing, testing after major changes, retesting of fixed findings and periodic assessments of high value assets. Combining testing with continuous monitoring and vulnerability management gives leaders a steady view of risk. For continuous coverage, see our guides to annual penetration testing and continuous penetration testing.

HACS for State and Local Governments

State agencies, counties, cities and school districts face many of the same threats as federal agencies, especially ransomware, but often with smaller security teams. Through cooperative purchasing, eligible state and local buyers can use the GSA schedule to order HACS penetration testing without running a full procurement from scratch. This can be especially helpful when grant funding, such as state and local cybersecurity grant programs, needs to be used within a fixed period. Check your own procurement rules to confirm that cooperative purchasing is allowed in your jurisdiction.

Preparing Your Agency for a Penetration Test

Good preparation makes HACS penetration testing faster and more useful. Before the kickoff meeting, agencies should gather the information testers need and line up the people who will support the engagement:

1. Confirm written authorization from the system owner and, where required, the authorizing official.
2. Prepare an accurate asset inventory, network diagrams and a list of in-scope applications.
3. Identify any systems that are fragile, mission critical or off limits, and agree how they will be handled.
4. Notify hosting providers, cloud service providers and security operations teams as required.
5. Create test accounts for authenticated application and internal testing.
6. Agree on emergency contacts and a process to pause testing if an issue occurs.
7. Plan how sensitive findings will be shared and stored securely.

Preparation also helps separate real attacker activity from authorized testing, which reduces confusion for security operations staff.

On-Site and Remote Testing

Many government penetration tests can be performed remotely through secure connections or a testing appliance placed on the internal network. Some work, such as physical security reviews, wireless testing or testing in classified or air-gapped environments, may require testers on site with appropriate clearances. Statements of work should state clearly which activities must happen on site, the clearance level required and any citizenship requirements for testers. For related guidance, see our article on physical penetration testing.

High Value Asset Assessments

Federal agencies designate certain systems as high value assets because of the data they hold or the mission functions they support. These systems receive extra scrutiny, including in-depth assessments that combine architecture review with risk and vulnerability testing. When planning HACS penetration testing for an HVA, include the paths that lead to the asset, such as administrator workstations, identity systems and connected applications, not only the asset itself.

Frequently Asked Questions About HACS Penetration Testing

What is HACS penetration testing?

HACS penetration testing is penetration testing purchased through the GSA Multiple Award Schedule under the Highly Adaptive Cybersecurity Services SIN 54151HACS.

What does HACS stand for?

HACS stands for Highly Adaptive Cybersecurity Services, a GSA schedule category for pre-vetted cybersecurity services.

Which services are included in HACS?

HACS covers penetration testing, risk and vulnerability assessments, high value asset assessments, incident response and cyber hunt.

Can state and local governments buy HACS services?

Many can, through GSA's Cooperative Purchasing program for IT schedule services. Confirm eligibility and local procurement rules first.

How are HACS vendors qualified?

Vendors must pass a technical evaluation for each HACS subcategory before they can offer those services on the schedule.

How often should agencies run penetration tests?

At least annually for most systems, after major changes, and as required by authorization, HVA or continuous monitoring requirements.

Final Thoughts

HACS penetration testing gives government buyers a faster path to qualified penetration testing vendors. Define clear requirements, write a strong statement of work, choose a vendor with real government experience, fix and retest findings, and build testing into a recurring program that supports authorization and oversight.

To learn how to buy penetration testing from Privaxi through GSA, explore Privaxi's GSA schedule services.